CVE-2026-84372 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-84372 requires immediate attention.

· 6 min read

Executive Summary

CVE-2026-84372 is a critical flaw in composer predis/predis (CVSS 9.8) that can let attacker-controlled data break Redis command boundaries inside pipeline() on aggregate connections. If your app uses Predis with cluster or replication and passes user input into pipelined keys or values, an unauthenticated attacker may be able to inject Redis commands or crash requests.

For small teams and solo developers, the main risk is simple: cache keys, slugs, session IDs, or other user-influenced strings can become a command injection path. On cluster setups this can mean shard-wide cache wipes, data tampering, or service disruption. On replication setups it can cause repeatable denial of service.

Immediate Action

  • Upgrade immediately to predis/predis 3.3.0+. If you cannot patch today, treat any app using pipeline() on cluster/replication connections as exposed.
  • Disable or bypass pipelining for any request path that includes user-controlled keys or values, especially URL slugs, cache keys, and session identifiers.
  • Roll back risky deployments if you recently enabled Predis clustering or replication and cannot confirm all pipelined inputs are trusted.
  • Isolate Redis from the public network, restrict access by firewall/security group, and ensure only application hosts can connect.
  • Review logs for unusual Redis activity such as unexpected FLUSHDB, DEL, SET, or sudden request failures.
  • See vendor guidance and release notes: Predis security advisory / release notes.

Affected Versions

  • predis/predis 3.0.0-RC1 through 3.2.0 are vulnerable.
  • predis/predis 3.3.0+ is the fixed line.
  • predis/predis 1.x and 2.x are not affected by this issue.
  • v3.0.0-alpha1 is not affected.

Resolution Guide

PHP / Composer

composer require predis/predis:^3.3.0
composer update predis/predis
composer show predis/predis

Lockfile-based installs

composer update --lock
php -r 'require "vendor/autoload.php"; echo \Predis\Client::class, PHP_EOL;'

Temporary hardening if you cannot upgrade right away:

// Avoid pipeline() on cluster/replication connections when any argument can be user-controlled.
$client = new Predis\Client($nodes, ['cluster' => 'predis']);

// Safer pattern: execute requests one-by-one for untrusted input.
$client->get('slug:' . $slug);

Minimal code fix example

// Before: vulnerable if $slug can contain CRLF or other attacker input
[$doc] = $client->pipeline()->get("slug:$slug")->execute();

// After: avoid pipeline for untrusted data
$doc = $client->get("slug:" . $slug);

Container / Docker

# Rebuild with the fixed dependency
docker build --no-cache -t myapp:patched .
docker run --rm myapp:patched

# If you pin images, rebuild from a clean lockfile after updating composer.json
# and composer.lock to predis/predis 3.3.0+

JavaScript / Python / Java / Linux package managers

Predis is a PHP package, so there is no direct npm/pip/Maven/apt/yum equivalent for the vulnerable library. If your stack wraps PHP in a container or service, update the PHP dependency with Composer, then rebuild the image or package.

# Example CI step
composer update predis/predis
docker build -t myapp:patched .

Detection & Verification

Check installed version

composer show predis/predis
grep -n '"predis/predis"' composer.lock

Find risky usage

grep -RIn "pipeline()" src/ app/

Look for code that combines pipeline() with user input, especially values derived from URLs, forms, headers, or session data. Pay extra attention to cluster or replication client configuration.

Verify the fix

# Before patch: a request with CRLF in a pipelined argument may crash or inject commands
curl 'http://127.0.0.1:8080/?slug=PAD4%0D%0A*1%0D%0A%247%0D%0AFLUSHDB'

# After patch: the same request should not execute injected Redis commands
# and should not trigger an uncaught fatal error.

You can also confirm the upgraded package version in runtime:

php -r 'require "vendor/autoload.php"; $v = Composer\InstalledVersions::getPrettyVersion("predis/predis"); echo $v, PHP_EOL;'

Risk and Impact

This issue can turn a normal cache lookup or queued write into a Redis command injection path. On cluster deployments, an attacker may wipe shards, poison cache entries, steal same-slot data, or disrupt nodes. On replication deployments, the flaw can crash requests reliably whenever attacker-controlled data contains CRLF sequences.

Even without proof of active exploitation, the blast radius is high because the vulnerable pattern is common in web apps: user-facing slugs, cache keys, and session identifiers often flow into Redis. If your service uses Predis pipelines with untrusted input, patch now and remove the risky code path until you are on 3.3.0+.

Keep reading